feat(pm-agent): an in-cluster AI Program Manager that turns Gitea issues into pull requests

A service that reads this repository's Gitea issues, decides what to do about each
thread as the Program Manager persona, and runs one worker agent per assignment that
authors a change, runs the merge gate and opens a pull request. It reacts to issue
creation and to comments; the assignment and all correspondence travel through the
issue thread and the PR. It authenticates with an Anthropic subscription token. It
never pushes to main and never merges.

Three choices carry the design, with alternatives recorded in docs/plans/:
 - it POLLS rather than receiving webhooks (Gitea's webhook SSRF guard, lost
   deliveries, and no inbound reach needed at all);
 - it keeps NO state: the trigger is "the newest thing in this thread was not
   written by me", so the issue thread is the state — no PVC, no backup obligation;
 - the model holds NO tools: its reply is one JSON object this code validates, so
   nothing in the path executes text.

The boundary is platform/kyverno/admission/pm-agent-job-shape.yaml (Enforce,
failurePolicy: Fail), not the RBAC: Kubernetes places no `use` check on
serviceAccountName, so "may create Jobs" is "may run arbitrary code as the
namespace's most privileged identity". Six rules admit only the committed shape, and
the worker identity is bound to nothing with no token mounted, so there is nothing to
escalate to. 28/28 offline Kyverno assertions.

Nothing has run: the image has never been built or pushed, and both the image digest
and the two credentials are deliberate placeholders. See the handoff entry's
"What I did NOT verify".

Refs CLAUDE.md §1/§3/§6, R-SEC-02, R-GITOPS-02.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

platform-config/kustomization.yaml

@@ -42,6 +42,14 @@ resources:
   # That is exactly how this policy shipped green and never reached the cluster on 2026-09-29,
   # leaving the conformance-trigger identity live with nothing bounding it.
   - ../platform/kyverno/admission/conformance-trigger-job-shape.yaml
+  # R-SEC-02 — bounds what the PM agent dispatcher may create (platform/pm-agent/). SAME
+  # REASON THIS LINE EXISTS AS THE ONE ABOVE, and the same consequence if it is omitted: this
+  # Kustomization is the only list that applies ClusterPolicies, so adding a policy to
+  # platform/kyverno/admission/kustomization.yaml alone is a SILENT NO-OP. The policy would
+  # pass `kyverno test`, pass the gate, and never reach the cluster — leaving a
+  # ServiceAccount that can create Jobs in a namespace, driven by a model reading untrusted
+  # issue text, with nothing bounding the shape of what it creates.
+  - ../platform/kyverno/admission/pm-agent-job-shape.yaml
   # cilium: L2 LB IP pool + announcement policy (cilium.io CRDs already registered by Cilium)
   - cilium/l2-ip-pool.yaml
   - cilium/l2-announcement-policy.yaml